The question company managers ask me most often, since the Commissioner started imposing fines, is a simple one: "Do we need a DPO?" The answer depends on three articles of Law No. 124/2024 "On the Protection of Personal Data", adopted on 19 December 2024 and in force since the beginning of 2025. This article explains them the way I apply them in practice, as a lawyer and as Data Protection Officer for Albanian and Italian companies since 2014.
1. When a DPO is mandatory
Article 33, paragraph 1, lists three cases. The controller and the processor, so also a company processing data on behalf of its clients, must appoint a Data Protection Officer when:
- a) the processing is carried out by a public authority or body, except courts acting in their judicial capacity;
- b) the core activities require regular and systematic monitoring of data subjects on a large scale;
- c) the core activities consist of large-scale processing of sensitive data or criminal data.
The law sets no numerical thresholds. The key terms are "core activities" and "large scale", interpreted in line with the European guidelines on DPOs (WP 243), which the Commissioner follows. In practice, point "b" covers call centres and telesales companies, online platforms and apps that track user behaviour, insurers and financial institutions, telecom operators, and companies running extensive video surveillance or fleet geolocation. Point "c" covers hospitals, clinics, laboratories, private schools, health and life insurers, and any business that handles health or biometric data as part of its activity.
A group of companies may appoint a single DPO, provided the officer is easily accessible from each member of the group (Article 33, paragraph 2). This is the usual solution for foreign groups with subsidiaries in Albania: the same DPO for the parent and for the Albanian entity.
Two clarifications that prevent the most common mistakes. First: the exemption for companies with fewer than 250 employees, which many people cite, applies to the record of processing activities (Article 27, paragraph 4), not to the DPO; a clinic with 15 employees may well be required to appoint one. Second: a company that appoints a DPO voluntarily (Article 33, paragraph 3) is bound by the same rules on the officer's position and independence as if the appointment were mandatory.
2. Who can be a DPO
Article 34, paragraph 2, requires three things: certified professional skills, good knowledge of data protection law and practice, and the ability to perform the tasks listed in Article 34. The law expressly allows two models:
- an internal DPO, a person employed by the controller or processor;
- an external DPO, a person engaged under a service contract.
The delicate point is conflict of interest. The DPO may hold other duties, but the controller must ensure they do not conflict with the role. European practice, followed by the Commissioner, excludes anyone who decides the purposes and means of processing: the managing director, the head of IT, the head of HR, the head of marketing. In a mid-sized Albanian company, an internal person free of conflicts often does not exist, which is the practical reason why the external DPO has become the prevailing model.
The law does not require the DPO to reside in Albania. It requires the officer to be accessible to data subjects and to the Commissioner, to know Albanian law and the Commissioner's practice, and to communicate in the language of employees and customers. For a foreign company with an office in Tirana, a DPO working in both languages and under both regimes (GDPR and Law 124/2024) discharges the Albanian and the European obligation at the same time.
3. What the DPO does and what the company owes the DPO
The tasks are listed in Article 34, paragraph 1: advising management, taking part in impact assessments (DPIA) under Article 31, informing and training staff, monitoring compliance with the law and internal policies, including audits, and acting as contact point for the Commissioner.
The part managers underestimate is what the company owes the officer:
- Publication of the DPO's contact details and notification of the appointment to the Commissioner (Article 34, paragraph 3). Without notification, as far as the Commissioner is concerned the DPO does not exist.
- Timely involvement in every data-related matter and adequate resources (paragraph 4). A DPO who learns of a new project after it has started is not performing the function.
- Independence (paragraph 5): the DPO receives no instructions on how to perform the tasks, is not dismissed or penalised for performing them, and reports directly to the highest management level.
- Confidentiality of the DPO regarding everything learned in the role (paragraph 4).
What is at stake without a DPO
Articles 33 and 34 belong to Chapter III of Part II of the law. Breach of the obligations in that chapter is punishable under Article 94, paragraph 1, with a fine of up to ALL 1,000,000,000 (roughly EUR 10 million) or, for companies, up to 2% of worldwide annual turnover, whichever is higher. The actual amount depends on the circumstances in Article 93: nature and duration of the breach, cooperation with the Commissioner, previous breaches. As I explained in the article on the first decisions with fines, a missing DPO rarely appears as a stand-alone breach; it shows up together with a missing record, missing notices and missing processor contracts, and makes the overall picture worse.
Five steps to do it properly
- A written assessment of whether one of the three cases in Article 33 applies. Even the conclusion "no obligation" must be documented, because the Commissioner asks for it.
- A decision of the managing director appointing the DPO, with name, contact details and a description of the position.
- A service contract for an external DPO, or an addendum to the employment contract for an internal one, with the independence guarantees of Article 34.
- Notification to the Commissioner and publication of the DPO's contact details in the privacy policy and in the notices to employees and customers.
- Involvement of the DPO in the record of processing activities, the DPIAs and the data breach procedure, so that the role does not stay on paper.
Three questions I get regularly
Can the company's lawyer also be the DPO? Yes, provided the lawyer does not decide the purposes of processing and representation in other matters creates no conflict with monitoring compliance. In practice, an external lawyer trained in data protection is one of the most suitable profiles, precisely because they are not part of the management structure.
Can one DPO cover several companies? Yes, both for groups (Article 33, paragraph 2) and for unrelated companies under separate service contracts, provided the officer has real time and resources for each.
What happens when the DPO leaves? Another one is appointed without delay, the Commissioner is notified again and the published contact details are updated. A period without a DPO is a period of non-compliance.
OnLaw Office and ITAKA7, the privacy consultancy I co-founded, provide external DPO services to Albanian and foreign companies, from the initial assessment to the notification of the Commissioner and ongoing monitoring, in Albanian, Italian and English. Contact us if you want to know, in writing and within a few days, whether your company is under the obligation.
